Privacy Policy

Introduction

AAFCANS respects and values your privacy and acknowledges that it has an obligation at law to protect the personal information of others, including customers, employees, contractors and other individuals.

Scope

This policy applies to all AAFCANS employees, directors, contractors and consultants.

Policy Statement

The following policy explains how and when personal information is collected, used, stored, and disclosed by AAFCANS in accordance with The Privacy Act 1988 and under the Australian Privacy Principles (APP). Please refer to the Office of the Australian Information Commissioner website (www.oaic.gov.au/privacy/australian-privacy-principles) for additional details on how the APP operates.

Personal Information

The Privacy Act defines ‘Personal information’ as information or an opinion about an identifiable individual, or an individual who is reasonably identifiable:
a. whether the information or opinion is true or not; and
b. whether the information or opinion is recorded in material form or not.

How we collect your information (APP 1)

The main purposes for which we collect personal information are:

• for recruitment and employment (including expressions of interest in working for AAFCANS);
• for administration and management purposes, including Government compliance;
• to reply to contact made by customers;
• for marketing, media and public relation purposes.

We collect personal information directly from each individual.  We only collect personal information where you have consented, or you would reasonably expect us to collect personal information in that way.

Anonymity and pseudonymity (APP 2)

AAFCANS will allow customers to communicate and transact with it anonymously or by using a pseudonym, wherever it is reasonable and practical.

Where AAFCANS is required or authorised by law (or court/tribunal), individuals will need to be identified.

Information collected (APP 3)

The type of information collected for employment or administrative purposes would typically include your name, date of birth, gender, contact details, email, job title and interests (business/financial). Where relevant, we many ask for other information such as bank account details, tax file numbers, other financial information, driver’s licence details or details of directorships.

This is not an exhaustive list, however, unless disclosed to you prior or as required under employment conditions, we will not usually collect sensitive information (e.g. race or ethnic origins, religious beliefs, physical or mental health or sexual orientation).

Since we work on Defence bases, and access to these bases is restricted, criminal, and other background records will be sought in connection with your employment at AAFCANS.

We will also ask if you are a Defence spouse or relative upon employment and record such
information for statistical purposes. As a government agency, we are required to report annually on staff members who identify as being of aboriginal and Torres Strait Islander descent, however, the provision of this information is completely voluntary. Gender identification is provided on a voluntary basis, for the benefit of that individual only.

All information reported under Government direction is provided in aggregated statistics and cannot be associated back to an individual unless required by law.

For contact and marketing purposes, information retained would be in accordance with the requirements of the account or electronic app. This would likely include name and email.

Unsolicited personal information (APP 4)

When we collect information about you, AAFCANS will make it clear to you, either at or before the time, or as soon as practicable afterwards, why we are collecting such information. If there are consequences for not providing requested information, AAFCANS will advise this at the time of the request (e.g. employment information required to onboard an individual).

If there is a chance that personal information may be disclosed to an overseas recipient, AAFCANS will advise the individual of that likelihood

Notification of the collection of information (APP 5)

When we collect information about you, AAFCANS will make it clear to you, either at or before the time, or as soon as practicable afterwards, why we are collecting such information. If there are consequences for not providing requested information, AAFCANS will advise this at the time of the request (e.g. employment information required to onboard an individual).

If there is a chance that personal information may be disclosed to an overseas recipient, AAFCANS will advise the individual of that likelihood.

How we use the information (APP 6)

We will only use personal information to respond to lawful requests, to answer your enquiry, for direct marketing purposes where your information has been provided for that specific purpose, or in relation to your employment/services as an employee, director, or contractor.

The information is held only for as long as it is required to fulfil the purposes for which it was collected or as required by law.

Direct marketing (APP 7)

AAFCANS will only use personal information we hold for the purpose of direct marketing if you provided this information for this specific purpose. Our direct marketing platforms include an option to opt out of receiving communications; if not actioned, direct marketing communications will continue to be utilised.

Personal information held by AAFCANS will not be disclosed to third parties except with your express permission (e.g. to a supplier as a result of competition, media and public relation events).

Cross border disclosure (APP 8)

AAFCANS may disclose personal information to overseas recipients when it is reasonably necessary for our business operations, including the use of secure cloud and technology service providers.
Typical overseas disclosures may occur in connection with:

• Microsoft 365 and Azure (data hosting and collaboration services, primarily located in Singapore and other regional data centres in Australia);
• Amazon Web Services (AWS) (website, POS and application hosting, primarily in Singapore and occasionally other accepted regions);
• Employment Hero (HRIS, payroll and employee management systems, which may store data in Singapore and other jurisdictions);
• Other approved service providers engaged to support AAFCANS operations and technology platforms. AAFCANS will take reasonable steps to ensure that any overseas recipient handles your personal information in a manner consistent with the Australian Privacy Principles, or that an exception under APP 8 applies — for example, where you have provided consent, or where
  disclosure is required or authorised by an Australian law, court or tribunal order. Where practicable, AAFCANS will notify you of the countries in which your information may be disclosed. AAFCANS will continue to maintain appropriate security, contractual, and governance measures to protect personal information and ensure its use remains consistent with this Privacy Policy and the Privacy Act 1988.

Email and website management

Whilst AAFCANS takes steps to provide a secure internet environment, you should be aware that there are inherent risks associated with the transmission of information via the internet.

Email addresses are collected from employees in accordance with this policy. If a person is not an employee, then we will record the email address when a message is sent to us. The email address will be used for the purpose for which it has been provided.

Our intranet or website may contain links to third party websites. If you access those websites (including via a link from our intranet/website) you will be subject to the privacy policy of that third party.

In some cases, those third-party providers may not be subject to The Privacy Act. AAFCANS will not be taken to endorse or accept responsibility for any privacy issues arising as a consequence of accessing that web-link.

We do not use electronic cookies. However, we may track your Internet use on our IT network.

If you use our IT network to visit social media websites or applications, any personal information or content that you contribute can be read, collected and used by other users.

We have no control over use that occurs through this medium and are not responsible for any use, misuse, or misappropriation by other users of any personal information or content so contributed. When using social media or social media websites, you should read and be aware of our social media Policy.

If you use our Wi-Fi network, we may track your device’s IP address when you register for our Wi-Fi service.

Use of Government related identifiers (APP 9)

AAFCANS does not use government-related identifiers. AAFCANS will not use or disclose a government related identifier unless the use or disclosure of the identifier is reasonably necessary for us to fulfil any obligations we may have to a government agency or an Australian State/Territory. It may also be required or authorised in accordance with Australian laws, Courts or Tribunals.

Quality of information (APP 10)

AAFCANS will take all reasonable steps to ensure that personal information we collect from you is accurate, up to date and complete. Where we collect information directly from you, we rely on you to supply accurate information and we may not consider further steps are required.

Our employment database is maintained directly by each employee. Whilst reminders may be sent to prompt detail updates, it is incumbent on each individual to maintain accurate and complete personal information records.

Security of information (APP 11)

The Privacy Act 1988 has specific provisions that prohibit any employee of AAFCANS from collecting, using or disclosing anyone’s personal information except in performing their duties and in specific situations permitted by law. Your personal information is disclosed in accordance with the law or with your written permission.

AAFCANS takes reasonable steps to protect the personal information it holds from misuse, interference, loss, and from unauthorised access, modification, or disclosure.

Personal information is stored in secure environments using a combination of physical and electronic safeguards. These include restricted access controls, encryption, network monitoring, and security policies that align with the Australian Signals Directorate’s Essential Eight strategies and Defence ICT standards where applicable.

AAFCANS uses reputable cloud service providers such as Microsoft 365, Amazon Web Services (AWS), and Employment Hero, which employ industry-standard data protection practices, including ISO 27001 certification and regional data hosting in line with Australian Privacy Act obligations.

Where information is stored with third-party service providers, AAFCANS ensures contractual obligations require the provider to protect personal information in accordance with applicable privacy laws and AAFCANS’ security requirements.

If AAFCANS no longer requires your personal information for any purpose, it will take reasonable steps to securely destroy or deidentify it, unless retention is required by law.

Commonwealth records can only be destroyed or altered in accordance with the Archives Act 1983. For example, payroll records including full personnel file, leave, accident records, and separation records must be retained for 75 years or 7 years after the last action, whichever is later.

Data breaches

In the event of a data breach involving personal information, AAFCANS is obliged to advise an individual where that breach is likely to result in serious harm. This is known as an ‘eligible data breach’.

This notification will include recommended actions for the steps that should be taken by the impacted individuals in response to this breach. AAFCANS will also notify the Australian Information Commissioner of the eligible data breach.

Definitions:
An eligible data breach is a breach that, under requirements of the Notifiable Data Breach (NDB) scheme, must be reported to affected individuals and to the Information Commissioner in the OAIC. When determining if a breach qualifies as an eligible data breach, the following criteria must be met:

• There is unauthorised access to or unauthorised disclosure of personal information, or a loss of personal information, that an entity holds
• This is likely to result in serious harm to one or more individuals, and
• The entity has not been able to prevent the likely risk of serious harm with remedial action Likelihood means the risk of serious harm to an individual is more probable than not – this does not include possible.

Serious harm is not defined by the OAIC however the following factors may be considered:

• The kind of information involved
•  The sensitivity of the information
• If the information is protected by one or more security measures, technology or
  methodology
• If the information is protected by one or more security measures – the likelihood that any of those security measures could be overcome
  • The persons, or the kinds of persons, who have obtained, or who could obtain, the information.
• The likelihood that the persons, or the kinds of persons, who:
• Have, or are likely to have, the intention of causing harm to any of the
  individuals to whom the information relates
• Have obtained, or could obtain, information or knowledge required to
  circumvent the security controls, technology or methodology in use
• The nature of the harm.

Contact us about privacy

For further information regarding this Privacy Statement or to advise of a breach of this Privacy Policy, please contact us via:

• telephone on 07 3155 5375 between 7.30am and 3.30 pm Monday to Friday
• in writing to the address below:

Head of Governance & Risk, AAFCANS
Post Box 4, Rattey Street Gallipoli Barracks, Enoggera Qld 4051

Tim Manic
Managing Director